trxswap[.]net

This domain, trxswap.net, is currently being investigated as a crypto drainer phishing site designed to trick cryptocurrency users into connecting their digital wallets and unknowingly authorizing malicious token transfers. The attackers typically mimic legitimate decentralized exchange interfaces or wallet connection prompts, then exploit smart contract interactions to drain funds once permissions are granted. Security teams consider this a high-risk threat because once a wallet is connected, assets can be transferred without further user confirmation, especially if the drainer includes features like permission harvesting or front-end manipulation to hide transaction outputs. PhishDestroy identifies this domain was registered on February 20, 2026 through WebNic.cc and currently resolves to IP address 148.251.53.175. Notably, it uses a valid Let's Encrypt SSL certificate, which increases credibility and reduces immediate suspicion. At the time of analysis, VirusTotal shows 0 detections across 95 scanners, indicating it remains largely undetected by traditional antivirus tools. Such low detection rates are common with newly registered phishing domains that use deception techniques like mimicking legitimate platforms, employing evasion to bypass automated checks, or relying on short operational lifetimes to evade long-term monitoring. If you visited trxswap.net or entered your wallet details, immediately disconnect your wallet from any unknown dApps or websites and revoke any unauthorized token approvals using tools such as revoke.cash or your wallet’s built-in allowance manager. Do not approve any suspicious transactions, even if they appear to be pending. Monitor your wallet and transactions closely for unusual activity and consider transferring remaining assets to a newly generated wallet with a different seed phrase. Report the domain to your wallet provider and security teams to help block future access.